Last updated 28 August 2026. Written from what the code actually does.
There are no accounts, no passwords, no analytics, no advertising, no tracking pixels and no third-party scripts. We cannot read your files, because they are encrypted before they leave your device and the key is never sent to us. Short messages never reach a server at all.
The contents of your files or messages. Encryption happens on your device using AES-128-GCM. The relay stores ciphertext it has no key for.
The decryption key. It travels between your two devices as sound. It is not uploaded, not logged and not recoverable by us. If you lose it, so do we.
Messages under 120 bytes. Short text is encoded directly into the chirp. No upload happens, and no server is involved in any way.
When a file or a longer message is sent, the relay receives the encrypted blob, its size, and the file name in plain form. The name is not encrypted, so avoid putting anything sensitive in a file name.
Encrypted blobs are deleted the moment they are downloaded once, and in any case after 15 minutes. A scheduled job removes anything that slips through. There is no archive and no backup.
Like any web server, ours records requests: the IP address, the page requested, the browser's user agent, the referring page, the host name used, and the response time. These are used to understand traffic and to rate-limit abuse, and they live in our hosting provider's rolling log buffer rather than in a database we query.
We also keep anonymous counters, such as how many transfers happened. They contain no identifiers and cannot be traced to a person.
Payments are handled entirely by Stripe. We never see or store your card details. Stripe holds your email address and payment record under its own privacy policy.
To unlock Pro you enter the email you paid with. We send it to Stripe to check for an active subscription, and we write a masked form of it to our logs, for example an***@example.com. We do not keep a customer list of our own.
The app uses the microphone only to listen for chirps, and only while you have listening switched on. Audio is decoded on the device and never recorded, stored or uploaded.
Files you receive are decrypted and saved on your phone, where they stay until you delete them. You can remove them at any time in Settings, or in the Files app under On My iPhone. Deleting the app removes them too. Your preferences are stored on the device and nowhere else.
The app contains no analytics and no third-party SDKs.
The key is sound, so anyone within earshot, or anything recording in the room, can capture it. chirpfile protects you from a remote attacker and from us. It does not protect you from someone standing next to you.
We hold no account and no profile to export or delete. For a Stripe payment record, contact us and we will pass the request on, or use Stripe's billing portal directly.
Questions about this policy: [email protected].